#50703 Ticket 48707 - ldapssotoken for authentication
Closed by spichugi. Opened by firstyear.
firstyear/389-ds-base 48707-ldap-token-impl-rs  into  master

Download 50703.patch

Bug Description: This implements LDAP ssotokens, a simple
but cryptographically strong method of providing "cookies" to clients
on request so that they can re-bind to a session at a later time. This
is required for the web portal so that the portal may remain "isolated"
without a strict security audit as the 389-ds server provides all
security features.

Fix Description: This adds the features for cookies with time limits up
to one day to be generated from a rust library. These can be "revoked"
globally by regeneration of the fernet key. Multiple DS servers can
accept the tokens if they all have the same key configured. The TTL
is adjustable based on site preferences. Additionally, sites that do
not compile rust features will not have the feature enabled.

https://pagure.io/389-ds-base/issue/48707

Author: William Brown william@blackhats.net.au

Review by: ???

Additionaly notes: this passes ASAN and LSAN, it works with rust enabled, and when disabled the feature is also disabled. Defaults inf was extended to allow the tests to verify they are not present.

Don't say it @mreynolds, I just spotted this incorrect comment syntax.

Pre-empting "why did you touch so much in libglobs.c". It's because of this call here, where we add the capability for a initval generator function to each slot type for the config.

rebased onto 1e33353d6553d8d56d1f59434f40cebc9ac480b7

Please don't use java style comments

AHhhhhh I swear I did a search for them all in the C code (Rust uses // for comments and /// for docs so we'll have to deal with it there).

1 new commit added

  • Fix misformatted comment

@mreynolds and @mhonek ping :)

Review reminder @mreynolds

Looks good, but I want to run a few tests with the patch. Question are there platforms that won't have rust (do we really need the #ifdefs)?

The ifdef is more about "readiness" and when both SUSE/RedHat say "yes we can ship this to production", so it gives us a fast on/off switch. Perfect world, we shouldn't need it, but "just in case". This way we can do a release, if it goes wrong we can ifdef it off rather than reverting the patch.

Is that a reasonable comment?

@firstyear, Matus has some comments on your design doc about adding a token refresh option:

https://github.com/marcus2376/389wiki/pull/17

Just bringing it to your attention

doe should "does"

Compiler error:

../389-ds-base/ldap/servers/slapd/bind.c: In function ‘do_bind’:
../389-ds-base/ldap/servers/slapd/bind.c:754:26: warning: implicit declaration of function ‘pw_verify_token_dn’; did you mean ‘pw_verify_be_dn’? [-Wimplicit-function-declaration]
754 | rc = pw_verify_token_dn(pb);
| ^~~~~~~~~~~~~~~~~~
| pw_verify_be_dn

Probably need to add it to header somewhere

Thanks for the comments @mreynolds I'll have a look at this today. I'm surprised about the missing definition for the header though :(

Maybe I should change my compiler opts to -Werror?

rebased onto 05aad782b01e904f8d7ec76c8e58f35d0a3366e8

Right, updated based on your feedback. Sometimes I wonder if you missed a career in spell checking :) :)

Also noted an issue with linking so that's resolved now.

Any other comments @mreynolds or @mhonek?

Your patch no longer cleanly applies to Master branch, but it looks like you still have the same problem I reported in https://pagure.io/389-ds-base/pull-request/50703#comment-104376

in bind.c you need to include pw_verify.h

Your patch no longer cleanly applies to Master branch, but it looks like you still have the same problem I reported in https://pagure.io/389-ds-base/pull-request/50703#comment-104376
in bind.c you need to include pw_verify.h

Blah, every time I click "Submit Comment" I think "Wait! Double check ______". Yes bind.c had this include already. I would really like a patch that applies cleanly to give my full ACK, so get this patch rebased and I'll give it a quick once over and we can finally merge it!

@mreynolds Doing it right now :)

rebased onto 5c23cf430fd540faebfd67b485f0bf660612e3b0

@mreynolds Doing it right now :)

Thanks I'll review this tomorrow!

rebased onto 65a1e3474b50c62df840055ad5ff2e7ce9469741

ACK! Nice. I ran a few tests everything seems okay. Lets get this in, and if anything pops up we'll fix it.

rebased onto 38fe768065f94cf0143dcd7c14d8c7e74ab4812d

Pull-Request has been merged by firstyear

Thanks so much @mreynolds!

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3758

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi

Metadata